=== div3440.c (counter-oracle variant) — guest run, patched-kernel boot (#1) ===
control A (16B sa, INADDR_ANY): rawout 0->0 (netstat key mismatch: DF label
  is "packets sent with fabricated ip header"; per-CPU counters not visible
  from the sending CPU)
control B (16B sa, 10.1.2.3):  rawout 0->0
tiny 4B sa run 0..4: rc=64 errno=0  => sendto ACCEPTED with a 4-byte
  destination sockaddr: div_output() read sin_port (4..8) and sin_addr
  (8..12) past the 4-byte allocation and reinjected the packet.

=== /tmp/two (full-stat diff probe) ===
dst=0.0.0.0 (16B sa, OUTPUT branch): "packets for this host" +1,
  "packets sent from this host" +2  (reinject reached ip_input via lo0)
dst=10.1.2.3 (16B sa, INPUT branch): total received +1, for this host +1,
  sent +2  => both branches active and observable only through noisy
  aggregate counters.

=== divleak.c (skipto canary readback attempt, ipfw2 divert rule 8675) ===
shot 0: sendto=48 errno=0; shots 1-5: errno=35 (EAGAIN)
no readback: reinjected packets never re-matched the divert rule.
Diagnosis: (a) ipfw hooks exist only in the ether layer (if_ethersubr.c:466,
1061) - loopback reinjects never traverse the firewall; (b) with
one_pass=1 reinjections are accepted before rule matching; with one_pass=0
the resume rule = divinfo->skipto = the very OOB bytes under test, which
were never < 100, so rule 100 could not match.

=== divsteer.c (groom steering attempt, usched_set-pinned to cpu0) ===
groom 0.0.0.0 + 9B sa: rule100 0->0 readback=-1  => INPUT
groom 1.2.3.4 + 9B sa: rule100 0->0 readback=-1  => INPUT
(6 shots: always INPUT; groom chunks not picked by the trigger allocation,
consistent with the verified DF-3357 experience on the same guest/allocator:
sys/kern/kern_slaballoc.c serves from ZoneAry tail zone chunk lists, and
locally-freed groom chunks do not reliably become the next 16-byte chunk).

=== conclusion ===
The unvalidated read executes on every shot (sendto with a 4/9-byte
sockaddr succeeds and the packet is reinjected), but the OOB byte values
could not be controlled or read back deterministically on this guest.